Abstract: A multiple attribute grey fuzzy Trojan detecting method based on behavior sequence is proposed to solve the problems of Trojan detection. Through qualitative analysis, Trojan attack tree was constructed. The probability level, that Trojan can complete different functions by the method of using leaves node of attack tree, was summed up. Behavior sequences of Trojan, including network communication, hidden running, starting up after power on and self-protection, were considered as the designing scheme of Trojan. Then, by the combination of grey system theory and fuzzy optimization method, the grey fuzzy optimal degree for each Trojan scheme can be calculated with the use of quantized qualitative index of fuzzy number. At last, Trojan was detected by comparing grey fuzzy optimal degree with the dangerous index. The example shows that above method can effectively distinguish the Trojan from normal program.